CVE-2026-98524: rds: ib: Clear the sg list when mapping an MR fails
In the Linux kernel, the following vulnerability has been resolved:
rds: ib: Clear the sg list when mapping an MR fails
rdsibmapfrmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, rdsrdmamap() unpins the pages and frees the scatterlist, but rdsibfreefrmr() can still return the MR to the pool with the stale pointer set.
This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down:
BUG: KASAN: slab-use-after-free in rdsibteardownmr Read of size 8
Call Trace: rdsibteardownmr rdsibunregfrmr rdsibflushmrpool rdsibflushmrs rdsfreemr rdssetsockopt
Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In rds_ib_map_frmr(), store the caller's scatterlist in the MR only after DMA mapping succeeds; if mapping or registration fails, unmap the scatterlist, clear the MR fields, and return without placing an MR with a stale scatterlist pointer back in the pool.